Sole Source Notification 20250485 FINAL.pdf

It is the intent of Washington State to promote open competition and transparency for all contracts for goods and services. In accordance with Department of Enterprise Service (DES) policy #DES-

140-00, all intended sole source contracts must be made available for public inspection for a period of not less than fifteen (15) working days before the start date of the contract. This Sole Source

Notification satisfies the requirement.

This Sole Source Notification is available at the Office of Superintendent of Public Instruction

(OSPI) website and at the Department of Enterprise Services, Washington Electronic Business

Solution (WEBS) Procurement website under the following commodity codes: 204-46: Imaging

Systems, Microcomputer (Including Digital Imaging Network (DIN), Technology, and Digital

Imaging Communications in Medicine (DICOM); 918-90: Strategic Technology Planning and

Consulting Services.

The Office of Superintendent of Public Instruction (OSPI) intends to award a $100,000 sole source contract to GGS Consulting for the period of March 2025, through June 30, 2027.

The primary focus of this contract is to provide expertise and support to K-12 school districts to build capacity around minimum cybersecurity needs. This includes development of a

Cybersecurity Guide and workbook, an OSPI Cybersecurity Strategic Support report, PEN-testing/Cyber hygiene testing strategy, implementing essential protective measures such as multifactor authentication, device administrative access, and network VPN and server security to safeguard school networks. The support will particularly target vulnerable districts and will involve strategic coordination and outreach in partnership with Educational Service Districts

(ESDs), Washington State Information Processing Center (WSIPC), the K-12 statewide procurement department, other school districts, and state and federal agencies.

The sole source justification for this contract is based on the unique expertise and established relationships that the contractor, GGS Consulting, possesses. GGS Consulting has a proven track record of working with educational institutions and state agencies to enhance cybersecurity measures. Their specialized knowledge and experience in the field of K-12 cybersecurity make them uniquely qualified to provide the necessary support and coordination required for this project. Additionally, their established relationships with key stakeholders such as OSPI, K20, WEA, WSIPC, ESDs, State CISO, WATECH, and CISA ensure a seamless and effective implementation of the cybersecurity measures.

Consultants contemplating the above requirements shall submit capability statements detailing their ability to meet the state’s requirements no later than 3:00 pm on March 17, 2025.

Sole Source Notification

Cybersecurity Strategic Support https://www.k12.wa.us/about-ospi/contracting-ospi/competitive-procurements https://www.k12.wa.us/about-ospi/contracting-ospi/competitive-procurements https://fortress.wa.gov/ga/webs/ https://fortress.wa.gov/ga/webs/

OSPI Sole Source Contract 20250485 Page 2 of 9

Capability statements must address the following state requirements:

• Exhibit a thorough understanding of K-12 school district IT systems and infrastructure, particularly in relation to the unique cybersecurity challenges and requirements faced by districts.

• Possess a proven track record of successfully leading and implementing robust cybersecurity solutions within K-12 school districts. This experience includes crafting and executing strategic plans to mitigate cybersecurity threats, working closely with key stakeholders to ensure alignment with district objectives, and continuously enhancing security protocols to safeguard sensitive data and comply with relevant regulations.

• Demonstrate the ability to design and implement tailored cybersecurity training programs for K-12 staff and students, ensuring they are well-equipped to recognize and respond to potential threats.

• Show proficiency in conducting thorough risk assessments and vulnerability analyses within K-12 environments, identifying critical areas for improvement and developing actionable plans to enhance security.

• Exhibit strong project management skills, overseeing the deployment of cybersecurity initiatives from inception to completion, while ensuring minimal disruption to the educational process and maintaining clear communication with all stakeholders.

In the absence of other qualified sources, and pending approval by the Department of Enterprise

Services, it is OSPI’s intent to make a sole source award of the contract mentioned above to GGS

Consulting.

Although this Sole Source Notification is not an invitation to bid, if you feel your firm is able to provide the goods or services listed above, you may submit a capability statement to:

Kyla Moore

Office of Superintendent of Public Instruction

Email: contracts@k12.wa.us

In accordance with DES Sole Source policy process #PRO-DES-140-00A, the following documents are attached:

• Attachment 1 – A copy of the Sole Source Contract Filing Justification

• Attachment 2 – A copy of the proposed draft sole source contract in significantly final form mailto:contracts@k12.wa.us

OSPI Sole Source Contract 20250485 Page 3 of 9

Attachment 1 – Sole Source Contract Filing Justification

Specific Problem or Need

• What is the business need or problem that requires this contract?

This contract addresses the need to work strategically to enhance the cybersecurity posture of school districts by promoting effective and reasonable security practices tailored to each district's unique needs. This approach aims to move away from a one-size-fits-all policy rubric that is often impractical and unsupported. Instead, the development of a strategic plan will focus on assisting districts in achieving what they consider to be reasonable security measures.

To achieve this, the proposed contractor will assist with the development of an OSPI

Cybersecurity Working Group to develop and implement a comprehensive K-12 cybersecurity strategy. This strategy will include the following key deliverables:

o Assessment of Cybersecurity Programming/Supports/Work Underway:

Development and implementation of a cybersecurity district needs assessment.

Convene meetings with Educational Service Districts (ESDs) to evaluate the current state of cybersecurity programming, prioritizing districts with unmet needs. This will involve assessing the cybersecurity posture and culture, annotating local goals and plans, identifying staffing shortfalls, and potentially developing a security "toolbox" and pen-testing services.

o Identification of vulnerable districts: Identify districts vulnerable due to the lack of on-site cyber-trained technical support, absence of active security policies, or lack of security concerns from administration.

o Development of a State-wide K-12 Cybersecurity Policy: Assist in creating a state-wide K-12 cybersecurity model policy to be distributed through Washington

State School Director’s Association partner. The policy will include two levels:

entry, and tier II, to accommodate small and medium-sized districts. Larger districts, which likely already have standing policies, will be addressed last. The policy will adopt a "Reasonable Security" approach and target security standards and assessments used by the State Auditor's Office, potentially coordinating with them to replicate the same assessment standards evaluation process.

o Implementation of Cybersecurity Policies: With a focus on vulnerable districts, ensure that all districts have a workable cybersecurity policy. This policy will include Multi-Factor authentication (MFA) for all staff members, tiered at three levels (Strong for Admins, Mid for Key Staff, and General for Teachers and other staff). It will also involve removing device admin access from general staff, securing network VPNs, and conducting penetration (pen) testing on exposed servers. Up-chain reporting.

OSPI Sole Source Contract 20250485 Page 4 of 9 o Cybersecurity Awareness Training: MFA on VPN, Phishing incident, As a secondary target, provide cybersecurity awareness training to enhance the overall security culture within districts.

Sole Source Criteria

• Describe the unique features, qualifications, abilities or expertise of the contractor proposed for this sole source contract.

GGS Consulting is owned and operated by Garren Shannon, the recently retired Director of Information Technology Services for the Pullman Public School District in Pullman, Washington. Mr. Shannon holds a bachelor's degree in Computer Science and a master's degree in Information Systems Administration. He is certified by the Project

Management Institute (PMI) and the Global Information Assurance Certification (GSEC), making him an expert in all aspects of IT administration.

Over the past 21 years, Mr. Shannon has been a prominent voice and lecturer in the

Washington State K-12 education community, raising awareness about IT administration challenges. He has earned the admiration and respect of his peers and colleagues across the Pacific Northwest. He has also served on the Washington K-20 Network Advisory

Committee (NAC) as an active panel member for the past 18 years.

His prior work experience includes six years at Washington State University as

Information Services (IS) Manager for the School of Electrical Engineering and Computer

Science, five years as a Microsoft Global Training Partner, and 12 years in the USAF as

Director of Maintenance Information Systems for the McChord Logistics Group

Command.

Mr. Shannon is a well-known and respected figure in K-12 school and educational service districts across Washington. As a district director, educator (from middle school to college level), and active Network Advisory Council (NAC) member, his insights into the needs of the OSPI community are invaluable. Mr. Shannon offers a unique perspective on IT and cybersecurity in K-12 education in Washington State. His leadership, experience, respect, and affable nature make him an ideal candidate to champion this advocacy work for OSPI Educational Technology.

• What kind of market research did the agency conduct to conclude that alternative sources were inappropriate or unavailable? Provide a narrative description of the agency’s due diligence in determining the basis for the sole source contract, including methods used by the agency to conduct a review of available sources such as researching trade publications, industry newsletters and the internet; contacting similar service providers; and reviewing statewide pricing trends and/or agreements.

OSPI’s Educational Technology Director has been actively leading cybersecurity support efforts within the agency. This includes organizing and facilitating monthly statewide cybersecurity meetings, incorporating cybersecurity-focused questions into the Annual

OSPI Sole Source Contract 20250485 Page 5 of 9

Technology Survey, and participating in the WaTech State and Local Cybersecurity Grant

Program. Additionally, the Director coordinates with the Cybersecurity Infrastructure

Security Agency (CISA), supports the Multi-State Information Sharing and Analysis

Center (MS-ISAC) with district communications and outreach, and advocates for a K-12 specific Top Level Domain (TLD). To further meet the needs of districts, increased and dedicated efforts to coordinate and strategize are essential at this time.

A thorough evaluation was conducted and resulted in the determination that other governmental resources outside OSPI are not available to perform the services of this proposed sole source contract more efficiently or cost-effectively. This evaluation considered the efforts of various entities working in the K-12 cybersecurity environment, including:

o Educational Service Districts (ESD): While ESDs provide valuable regional support to school districts, their resources and focus are often spread across multiple districts, limiting their capacity to deliver specialized, statewide cybersecurity services.

o Washington School Information Processing Cooperative (WSIPC): WSIPC offers technology solutions and support to member districts, but their primary focus is on information processing and management rather than comprehensive cybersecurity services.

o WaTech: As the state's central technology agency, WaTech provides a range of

IT services. However, their broad mandate means they cannot dedicate the focused attention required for K-12 cybersecurity needs.

o Federal Agencies (CISA and MS-ISAC): The Cybersecurity and Infrastructure

Security Agency (CISA) and the Multi-State Information Sharing and Analysis

Center (MS-ISAC) offer critical cybersecurity support and resources. However, their efforts are national in scope and not tailored specifically to the unique needs of Washington State's K-12 education system.

Despite the valuable contributions of these entities, the specialized nature of the services required, combined with the need for a coordinated and strategic approach tailored to the specific needs of Washington State's K-12 schools, necessitates a sole source contract. This ensures dedicated, efficient, and cost-effective delivery of cybersecurity services that align with the unique requirements of the OSPI community.

• As part of the market research, include a list of statewide contracts review and/or businesses contacted, date of contact, method of contact (telephone, mail, e-mail, other), and documentation demonstrating an explanation of why those businesses could not or would not, under any circumstances, perform the contract; or an explanation of why the agency has determined that no businesses other than the prospective contractor can perform the contract.

Upon reviewing the NASPO contract for Information Security Services OSPI determined it does not fully address the comprehensive needs of the agency because it is primarily

OSPI Sole Source Contract 20250485 Page 6 of 9 focused on the technical aspects of Information Security Services, yet does not consider several critical requirements:

o Extensive K12 Experience and Knowledge: GGS Consulting brings a wealth of experience in the K12 technology environment. Our work relies on building trusting relationships to develop nuanced cybersecurity plans tailored to the diverse needs of various school districts.

o K12 Guidance Development: GGS Consulting possesses a deep understanding of the unique challenges faced by districts with restricted resources, including rural districts. This expertise is essential for creating practical and actionable guidance for school districts. This scope of work is outside the NASPO listed categories.

o Cybersecurity Guide: GGS Consulting will collaborate with OSPI, key partners, and stakeholders to develop and pilot a statewide Cybersecurity Guide, ensuring comprehensive and effective cybersecurity measures. This scope of work is outside the NASPO listed categories.

o Impact on Timeline: GGS Consulting's established relationships with Educational

Service Districts, school districts, and partners enable us to efficiently step into and complete the scope of work outlined in the contract in the determined timeline.

• Per the Supplier Diversity Policy, DES-090-06: was this purchase included in the agency’s forecasted needs report?

No.

• Describe what targeted industry outreach was completed to locate small and/or veteran-owned businesses to meet the agency’s need.

The proposed contractor’s WEBS profile indicates it is a veteran-owned, Washington-based micro business.

• What considerations were given to unbundling the goods and/or services in this contract, which would provide opportunities for Washington small, diverse, and/or veteran-owned businesses. Provide a summary of your agency’s unbundling analysis for this contract.

Using DES’ Unbundling Analysis Worksheet, it was determined that the work is unlikely/unreasonable to unbundle due to geographic area, size and complexity, and timing. Additionally, the proposed contractor’s WEBS profile indicates it is a veteran-owned, Washington-based micro business.

• Provide a detailed and compelling description that includes quantification of the costs and risks mitigated by contracting with this contractor (i.e. learning curve, follow-up nature).

Cybersecurity attacks on school districts have significantly increased since the COVID-19 pandemic, with K-12 institutions being considered "soft" and "easy" targets. By contracting with GGS Consulting, the following costs and risks will be mitigated:

OSPI Sole Source Contract 20250485 Page 7 of 9 o Elimination of Learning Curve Costs: GGS Consulting brings immediate expertise in K-12 cybersecurity, saving the district the substantial costs associated with training and onboarding new staff to understand K-12-specific needs.

o Building Trusting Relationships: GGS Consulting has pre-established relationships with district technology leadership, eliminating the time and effort required to develop these crucial connections from scratch, which can often take months or even years.

o Reduction in Start-Up Time: With GGS Consulting's deep understanding of the

K-12 landscape, the district avoids the initial delays and inefficiencies typically associated with new cybersecurity initiatives. This rapid deployment can prevent potential breaches during the vulnerable start-up phase.

o Navigating Opportunities and Challenges: GGS Consulting's familiarity with the unique opportunities, challenges, and barriers within the K-12 sector ensures that districts can swiftly and effectively implement cybersecurity measures, avoiding costly trial-and-error approaches.

o Support districts with understanding and planning for the State Auditor Office's

(SAO) Cybersecurity Performance Audit. Through this process, develop a positive working relationship between OSPI, districts, and the SAO.

• Is the agency proposing this sole source contract because of special circumstances such as confidential investigations, copyright restrictions, etc.? If so, please describe.

• Is the agency proposing this sole source contract because of unavoidable, critical time delays or issues that prevented the agency from completing this acquisition using a competitive process? If so, please describe. For example, if time constraints are applicable, identify when the agency was on notice of the need for the goods and/or service, the entity that imposed the constraints, explain the authority of that entity to impose them, and provide the timelines within which work must be accomplished.

• What are the consequences of not having this sole source filing approved? Describe in detail the impact to the agency and to services it provides if this sole source filing is not approved.

If this sole source contract is not approved and we are unable to work with the proposed contractor, it could lead to several significant consequences for school districts throughout the state:

o Increased Vulnerability to Cyberattacks: Without the specialized expertise of GGS

Consulting, districts may be more susceptible to cyberattacks, which can lead to data breaches, loss of sensitive information, and disruption of educational activities.

o Higher Costs and Delays: Districts would need to invest time and scarce resources in training new staff or hiring other consultants who may not have the same level

OSPI Sole Source Contract 20250485 Page 8 of 9 of familiarity with K-12 cybersecurity needs. This can result in higher costs and delays in implementing effective security measures.

o Lack of Established Relationships: Building trust and effective communication with district technology leadership from scratch can be time-consuming. GGS

Consulting already has these relationships, which can facilitate smoother and faster implementation of cybersecurity strategies.

o Prolonged Start-Up Phase: Without GGS Consulting's immediate understanding of the K-12 landscape, districts might face a prolonged start-up phase, during which they remain vulnerable to cyber threats.

o Inefficient Handling of Sector-Specific Challenges: GGS Consulting's experience with the unique challenges and opportunities in the K-12 sector ensures that cybersecurity measures are tailored and effective. Without their expertise, districts might struggle with a trial-and-error approach, leading to inefficiencies and potential security gaps.

o SAO Cybersecurity Performance Audit Preparation: Districts may be negatively impacted due to lack of understanding and preparation for SAO audits.

Reasonableness of Cost

• Since competition was not used as the means for procurement, how did the agency conclude that the costs, fees, or rates negotiated are fair and reasonable? Please make a comparison with comparable contracts, use the results of a market survey, or employ some other appropriate means calculated to make such a determination.

Based on market research, GGS Consulting's hourly fee of $150 is a competitive rate given the contractor’s extensive experience, expertise, and training. Market research included Bureau of Labor Statistics and ISC2 Cybersecurity Workforce Study resources.

1. General Overview: The average hourly rate for cybersecurity contractors in the U.S.

varies widely based on experience, location, and specific skills. Generally, rates range from $50 to $150 per hour.

2. Industry-Specific Rates:

o Financial Services: Contractors in this sector often command higher rates, typically between $100 and $200 per hour due to the high stakes of data security.

o Healthcare: Rates here range from $80 to $160 per hour, reflecting the critical need for protecting sensitive patient information.

o Government and Defense: These sectors also see higher rates, often between $90 and $180 per hour, given the importance of national security.

3. Geographic Variations:

o California: Contractors in tech hubs like Silicon Valley can earn between $100 and

$200 per hour.

OSPI Sole Source Contract 20250485 Page 9 of 9 o Washington, D.C.: Due to the concentration of government agencies, rates here are typically between $90 and $180 per hour.

o Texas: Rates in cities like Austin and Dallas range from $70 to $150 per hour.

4. Skill-Specific Rates:

o Penetration Testing: Specialists in this area can charge between $100 and $200 per hour.

o Incident Response: Rates for these experts range from $90 to $180 per hour.

o Security Architecture: Professionals in this field typically earn between $80 and

$170 per hour.

Attachment 2 – Proposed Draft Sole Source Contract

See next page

Page 1 of 7 Contract 20250485 between OSPI and Garren Shannon DBA GGS Consulting (Rev. 09/24)

CONTRACT FOR SERVICES

Contract No. 20250485 between

SUPERINTENDENT OF PUBLIC INSTRUCTION,

STATE OF WASHINGTON

(hereinafter referred to as Superintendent/OSPI) Old Capitol Building, PO Box 47200

Olympia, WA 98504-7200 and

GARREN SHANNON

DBA GGS CONSULTING

(hereinafter referred to as Contractor)

Unified Business Identifier #604-465-700-001

In consideration of the promises and conditions contained herein, Superintendent and Contractor do mutually agree as follows:

I. DUTIES OF THE CONTRACTOR

I.A. General Objective. The general objectives of this Contract are as follows:

The primary contract focus is on providing expertise and support to K-20 Education Network districts to build capacity around minimum cybersecurity needs to implement essential protective measures such as multifactor authentication, device administrative access, and network VPN and server security to safeguard school networks. With a focus on vulnerable districts, this support will include strategic coordination and outreach on behalf of districts in partnership with Educational Service Districts (ESDs), Washington State Information Processing Center (WSIPC), the K-12 statewide procurement department, other school districts, and state and federal agencies.

Services will include:

• Provide consultation on OSPI cybersecurity resources webpage

• Assist with establishing and assisting districts with statewide K-12 cybersecurity related communications

• District identification and outreach

• District assistance with planning and procurement process

• Virtual and on-location implementation support

• Strategic coordination and ongoing communications with key stakeholders

• State-wide strategic planning and meeting facilitation

Page 2 of 7 Contract 20250485 between OSPI and Garren Shannon DBA GGS Consulting

I.B. Scope of Work. In order to accomplish the general objectives of this Contract, Contractor shall perform the following specific duties to the satisfaction of the OSPI Contract Manager:

Identify all districts needing to meet the minimum cybersecurity protective measures which includes:

• In Year 1, Contractor shall conduct outreach and needs assessments with Educational Service Districts (ESDs) and partners to identify cybersecurity needs.

Contractor shall establish contact with target districts and perform a minimum needs assessment to understand their specific requirements. Based on these assessments, Contractor shall develop guidelines and reasonable cybersecurity plans tailored for the identified districts.

Contractor shall review and assess the cybersecurity posture and culture of districts, evaluating their resources. Contractor shall assist priority districts in deploying Multi- Factor Authentication (MFA) to enhance security. Contractor shall provide network analysis and review IT Administrator access audits to ensure proper security measures are in place. Contractor shall conduct a survey to analyze the cost impact of cybersecurity incidents on districts.

Contractor shall collaborate with state agencies and other partners, including OSPI, K20, WEA, WSIPC, ESDs, State CISO, WATECH, and CISA, to develop the OSPI Cybersecurity Strategic Support Recommendations document.

• In Year 2, Contractor shall create a multi-tiered Cybersecurity Guide and Workbook to support districts in self-help initiatives. This guide shall be piloted with volunteer districts to gather feedback and make necessary adjustments. A findings report shall be prepared, and the guide will be adjusted accordingly for full deployment.

Contractor shall will deploy the Cybersecurity Guide and provide direct support to priority districts to ensure effective implementation.

Contractor shall develop an initial strategy for penetration testing and cyber hygiene testing, partnering with the State CISO, WSIPC, and ESDs.

• In Year 3, Contractor shall extend district support to maintain and enhance cybersecurity measures and provide final recommendations.

I.C. Deliverables. The Contractor shall provide the following deliverables to the OSPI Contract Manager by the dates indicated below:

SCHEDULE OF DELIVERABLES

Deliverables Due Date

2025 - Outreach/Connections: Phase 1 Reports to include status update on the following tasks

1. ESD and partner outreach and needs assessment

2. Target district contacts and outreach – Minimum Needs

Assessment

3/15/2025 4/15/2025 5/15/2025 6/15/2025

Page 3 of 7 Contract 20250485 between OSPI and Garren Shannon DBA GGS Consulting

SCHEDULE OF DELIVERABLES

Deliverables Due Date

3. Develop district guidelines and reasonable cybersecurity plans, distribute to identified districts

Direct Support for Priority and Secondary At-risk Districts: Phase 2 Reports to include status update on the following tasks

1. District cybersecurity posture/culture review and assess resources

2. Assist priority districts with Multi-Factor Authentication (MFA) deployment

3. Provide network analysis, review IT Admin access audit

4. Cybersecurity incident impact cost analysis survey

7/15/2025 8/15/2025 9/15/2025

Preliminary Statewide Cybersecurity Strategic Support: Phase 3 Reports to include status update on the following task

1. Work with state agencies and other partners (OSPI, K20, WEA, WSIPC, ESDs, State CISO, WATECH, CISA) to develop OSPI Cybersecurity Strategic Support document

10/15/2025 11/15/2025 12/15/2025

2026 - Develop & Pilot Guideline/Best Practices: Phase 1 Reports to include status update on the following tasks

1. Develop multi-tiered Cybersecurity Guide and Workbook for district self-help support.

2. Pilot Cyber-Guide with volunteer districts

3. Findings Report/Guide Adjustment and full deployment preparation

1/15/2026 2/15/2026 3/15/2026 4/15/2026

Deploy & Support Guideline/Best Practices: Phase 2 Reports to include status update on the following task

1. Deploy Guide and provide direct support to priority districts

5/15/2026 6/15/2026 7/15/2026 8/15/2026 9/15/2026

Guideline/Best Practices: Phase 3 Reports to include status update on the following task

1. Develop Initial Pen-Testing/Cyber Hygiene testing strategy

– partnering with State CISO, WSIPC and ESDs

10/15/2026 11/15/2026 12/15/2026

2027 - Extended District Support: Final support reports and recommendations

1. Extended district supports, draft and final recommendations

1/15/2027 2/15/2027 3/15/2027 4/15/2027 5/15/2027 6/15/2027

Page 4 of 7 Contract 20250485 between OSPI and Garren Shannon DBA GGS Consulting

II. PERIOD OF PERFORMANCE

Contractor shall not commence performance, or be entitled to compensation or reimbursement for any services rendered, prior to the occurrence of each of the following conditions: (1) This Contract must be executed by a representative of the Contractor and the Superintendent; (2) Provisions of Chapter 39.26 RCW require the Agency to file this sole source Contract with the Department of Enterprise Services (DES) for approval; no Contract so filed is effective nor shall work commence under it until the fifteenth (15th) working day following the date of filing, subject to DES approval. In the event DES fails to approve the Contract, the Contract shall be null and void; and, (3) Contract Manager must confirm the occurrence of conditions number one (1) and two (2) and notify the Contractor to commence performance.

The schedule of performance of Contractor’s duties is as follows subject, however, to the three

(3) prior conditions to commencement of performance set forth immediately above:

March 18, 2025, date of approval by DES, or date of execution, whichever is later, through June 30, 2027.

Year 1: Contract commencement, through June 30, 2025 Year 2: July 1, 2025, through June 30, 2026 Year 3: July 1, 2026, through June 30, 2027

III. INVOICING & PAYMENT

III.A.1. Compensation Amount. In consideration of Contractor’s satisfactory performance of the duties set forth herein, Superintendent shall compensate Contractor at an hourly rate of one hundred and fifty dollars ($150) for services rendered not to exceed a total of one hundred thousand dollars ($100,000), inclusive of travel and all other contract-related costs. Payment for satisfactory performance shall not exceed this amount unless the parties mutually agree to a higher amount prior to the commencement of any work, which will cause the maximum payment to be increased.

III.A.2. Funding Source. Funds for the payment of this Contract are provided by state dollars.

III.A.3. All expenses necessary to the Contractor’s performance of this Contract not specifically mentioned in the Contract shall be borne in full by the Contractor.

III.B.1. Billing Procedure. Payment shall be made to the Contractor as follows:

Contractor shall submit invoices to the OSPI Contract Manager monthly per the Schedule of Payments.

SCHEDULE OF PAYMENTS

Deliverables Deliverable Due Date

Payment Amount

2025 - Outreach/Connections: Phase 1 Reports to include status update on the following tasks

1. ESD and partner outreach and needs assessment

2. Target district contacts and outreach – Minimum Needs Assessment

3/15/2025 4/15/2025 5/15/2025 6/15/2025

Hourly rate

Page 5 of 7 Contract 20250485 between OSPI and Garren Shannon DBA GGS Consulting

SCHEDULE OF PAYMENTS

Deliverables Deliverable Due Date

Payment Amount

3. Develop district guidelines and reasonable cybersecurity plans for identified districts, distribute to identified districts

Direct Support for Priority and Secondary At-risk Districts: Phase 2 Reports to include status update on the following tasks

1. District cybersecurity posture/culture review and assess resources

2. Assist priority districts with Multi-Factor Authentication (MFA) deployment

3. Provide network analysis, review IT Admin access audit

4. Cybersecurity incident impact cost analysis survey

7/15/2025 8/15/2025 9/15/2025

Hourly rate

Preliminary Statewide Cybersecurity Strategic Support: Phase 3 Reports to include status update on the following tasks

1. Work with state agencies and other partners (OSPI, K20, WEA, WSIPC, ESDs, State CISO, WATECH, CISA) to develop OSPI Cybersecurity Strategic Support document

10/15/2025 11/15/2025 12/15/2025

Hourly rate

2026: Develop & Pilot Guideline/Best Practices: Phase 1 Reports to include status update on the following tasks

1. Develop multi-tiered Cybersecurity Guide and Workbook for district self-help support.

2. Pilot Cyber-Guide with volunteer districts

3. Findings Report/Guide Adjustment and full deployment preparation

1/15/2026 2/15/2026 3/15/2026 4/15/2026

Hourly rate

Deploy & Support Guideline/Best Practices: Phase 2 Reports to include status update on the following task

1. Deploy Guide and provide direct support to priority districts

5/15/2026 6/15/2026 7/15/2026 8/15/2026 9/15/2026

Hourly rate

Guideline/Best Practices: Phase 3 Reports to include status update on the following task

1. Develop Initial Pen-Testing/Cyber Hygiene testing strategy – partnering with State CISO, WSIPC and ESDs)

10/15/2026 11/15/2026 12/15/2026

Hourly rate

2027 - Extended District Support: Final support reports and recommendations

1. Extended district supports, draft and final recommendations

1/15/2027 2/15/2027 3/15/2027 4/15/2027 5/15/2027 6/15/2027

Hourly rate

Page 6 of 7 Contract 20250485 between OSPI and Garren Shannon DBA GGS Consulting

III.B.2. Invoice Requirements. The invoices shall document to the OSPI Contract Manager’s satisfaction a description of the work performed, and payment requested. Within approximately thirty (30) calendar days of the OSPI Contract Manager receiving and approving the invoice, payment will be mailed or electronically transferred to the Contractor by Agency Financial Services, OSPI.

The invoices must be emailed to the OSPI Contract Manager and shall include:

• OSPI Contract number

• Contractor name, address, telephone number, and email address for billing issues if someone other than the Contractor’s Contract Manager

• Contractor’s Federal Tax Identification Number

• Contractor’s Statewide Vendor Number

• Description of Services and Deliverables provided

• Date(s) of Service, if applicable

• Invoice amount for each Service or Deliverable, including applicable taxes

Contractor’s invoices for payment shall reflect accurate Contract prices. Invoices will not be processed for payment until receipt of a complete invoice as specified herein. OSPI shall have no obligation to pay Contractor for any services that do not comply with this Contract.

III.B.3. Errors. If errors are found in the submitted invoice or supporting documents, the OSPI Contract Manager will notify the Contractor. In order to receive payment, it shall be the responsibility of the Contractor to make corrections in a timely manner, resubmit the invoice and/or supporting documentation as requested, and notify the OSPI Contract Manager.

III.B.1. Final Payment. Final payment shall be made after acceptance by the OSPI Contract Manager if received within sixty (60) days after the Contract expiration date, unless negotiated with the OSPI Contract Manager and the Fiscal Budget Analyst. There will be no obligation to pay any claims that are submitted sixty-one (61) or more calendar days after the expiration date (“Belated Claims”). Belated Claims will be paid at OSPI’s sole discretion, and any such potential payment is contingent upon the availability of funds.

IV. CONTRACT MANAGEMENT

The following shall be the contact person for all communications and billings regarding the performance of this contract. Any changes to this information shall be communicated to the other party in writing as soon as reasonably possible.

Contractor OSPI

Intentionally left blank Intentionally left blank

Page 7 of 7 Contract 20250485 between OSPI and Garren Shannon DBA GGS Consulting

V. INCORPORATION OF ATTACHMENTS AND ORDER OF PRECEDENCE

Each of the attachments listed below is by this reference hereby incorporated into this Contract.

In the event of an inconsistency in this Contract, the inconsistency shall be resolved by giving precedence in the following order:

• Applicable Federal and state of Washington statutes and regulations

• Special Terms and Conditions as contained in this basic contract instrument

• Attachment A – Contract for Services, General Terms and Conditions

• Any other provision, term or material incorporated herein by reference or otherwise incorporated.

VI. APPROVAL

This Contract shall be subject to the written approval of the Superintendent’s authorized representative and shall not be binding until so approved. The Contract may be altered, amended, or waived only by a written amendment executed by both parties.

We the undersigned agree to the terms of the foregoing Contract.

GGS Consulting Superintendent of Public Instruction

State of Washington

Signature Kyla L. Moore, Contracts Administrator

Printed Name Date

Title

Date

Who certifies that he/she is the Contractor identified herein, OR a person duly qualified and authorized to bind the Contractor so identified to the foregoing Agreement.

Approved as to FORM ONLY by the Assistant Attorney General

Page 1 of 14 Contract 20250485 Attachment A – General Terms and Conditions between OSPI and Garren Shannon DBA GGS Consulting FORM SPI D-283 (Rev. 12/23)

Attachment A Contract for Services

GENERAL TERMS AND CONDITIONS

Definitions. As used throughout this Contract and General Terms and Conditions, the following terms shall have the meaning set forth below:

“Contract” or “Agreement” means the entire written agreement between OSPI and the Contractor, including any attachments, exhibits, documents, or materials incorporated by reference. Contract and Agreement may be used interchangeably.

"Contractor" shall mean that firm, provider, organization, individual, or other entity performing service(s) under this Contract, and shall include all employees of the Contractor.

“Services” means all work performed or provided by Contractor pursuant to this Contract.

“Statement of Work” or “SOW” or “Scope of Work” means a detailed description of the work activities the Contractor is required to perform under the terms and conditions of this Contract, including the deliverables and timeline.

"Subcontractor" shall mean one not in the employment of the Contractor, who is performing all or part of those services under this Contract under a separate contract with the Contractor. The terms " Subcontractor" and " Subcontractors" means Subcontractor(s) in any tier.

"Superintendent" shall mean the Office of Superintendent of Public Instruction (OSPI) of the State of Washington, any division, section, office, unit or other entity of the Superintendent, or any of the officers or other officials lawfully representing the Superintendent. Superintendent and OSPI may be used interchangeably.

1. Access to Data. In compliance with Chapter 39.26 RCW, the Contractor shall provide access to data generated under this Contract to the Superintendent, the Joint Legislative Audit and Review Committee, and the State Auditor at no additional cost. This includes access to all information that supports the findings, conclusions, and recommendations of the Contractor’s reports, including computer models and methodology for those models.

2. Alterations and Amendments. This Contract may be amended only by mutual agreement of the parties. Such amendments shall not be binding unless they are in writing and signed by personnel authorized to bind each of the parties.

3. Americans with Disabilities Act (ADA) of 1990, Public Law 101-336, also referred to as the “ADA” 28 CFR Part 35. The Contractor must comply with the ADA, which provides comprehensive civil rights protection to individuals with disabilities in the areas of employment, public accommodations, state and local government services, and telecommunications.

4. Assignment. Neither this Contract, nor any claim arising under this Contract, shall be transferred or assigned by the Contractor without prior written consent of the Superintendent.

5. Assurances. The Superintendent and the Contractor agree that all activity pursuant to this

Contract will be in accordance with all applicable current federal, state and local laws, rules and regulations.

Page 2 of 14 Contract 20250485 Attachment A – General Terms and Conditions between OSPI and

FORM SPI D-283 (Rev. 12/23)

6. Attorney’s Fees. In the event of litigation or other action brought to enforce contract terms, each party agrees to bear its own attorney’s fees and costs.

7. Audit Requirements. If the Contractor is a Subrecipient of federal awards as defined by the

Office of Management and Budget (OMB) CFR, Part 200, Subpart F, and expends seven hundred and fifty thousand dollars ($750,000) or more in federal awards (does not apply to contracts for goods and services) from all federal sources in any fiscal year beginning on or after December 26, 2014, the Contractor shall procure at their expense a single or program-specific audit for that year. The Contractor shall incorporate OMB CFR, Part 200, Subpart F audit requirements into all contracts between the Contractor and its Subcontractors who are Subrecipients of federal awards. The Contractor shall comply with any future amendments to OMB and any successor or replacement Circular or regulation.

8. Budget Revisions. Any monetary amount budgeted by the terms of this Contract for various activities and line-item objects of expenditure may be revised without prior written approval of Superintendent, so long as the revision is no more than ten percent (10%) of the original line item amount and the increase in an amount is offset by a decrease in one or more other amounts equal to or greater than the increase. All other budget revisions exceeding ten percent (10%) shall only be made with the prior written approval of the Superintendent.

9. Certification Regarding Debarment, Suspension, and Ineligibility. The Contractor certifies that neither it nor its principals are debarred, suspended, proposed for debarment, or voluntarily excluded from participation in transactions by any federal department or agency. The Contractor further certifies that they will ensure that potential subcontractors or any of their principals are not debarred, suspended, proposed for debarment, or voluntarily excluded from participation in covered transactions by any federal department or agency.

“Covered transactions” include procurement contracts for goods that are expected to equal or exceed twenty-five thousand dollars ($25,000). Contractor may do so by obtaining a certification statement from the potential subcontractor or subrecipient or by checking online at the System for Award Management (SAM), Excluded Parties List. The Contractor shall immediately notify the Superintendent if, during the term of this contract, Contractor becomes debarred. The Superintendent may immediately terminate this Contract by providing Contractor written notice if Contractor becomes debarred during the term of this Contract.

The Contractor also certifies that neither it nor its principals are debarred, suspended, or proposed for debarment from participation in transactions by any state department or agency. The Contractor further certifies that they will ensure that potential subcontractors or any of their principals are not debarred, suspended, or proposed for debarment from participation in covered transactions by any state department or agency.

10. Certification Regarding Lobbying. The Contractor certifies that Federal-appropriated funds will not be used to pay any person or organization for influencing or attempting to influence an officer or employee of any agency, a member of Congress, officer or employee of Congress or an employee of a member of Congress in obtaining any Federal contract, grant or any other award covered by 31 USC 1352. Contractor must also disclose any lobbying with non-Federal funds that takes place in connection with obtaining any Federal award. Contractor shall require its subcontractors to certify compliance with this provision.

Page 3 of 14 Contract 20250485 Attachment A – General Terms and Conditions between OSPI and

FORM SPI D-283 (Rev. 12/23)

11. Certification Regarding Wage Violations. The Contractor certifies that within three (3) years prior to the date of execution of this Contract, Contractor has not been determined by a final and binding citation and notice of assessment issued by the Washington Department of Labor and Industries or through a civil judgment entered by a court of limited or general jurisdiction to have willfully violated, as defined in RCW 49.48.082, any provision of RCW chapters 49.46, 49.48, or 49.52.

The Contractor further certifies that it will remain in compliance with these requirements during the term of this Contract. Contractor will immediately notify the Superintendent of any finding of a willful violation entered by the Washington Department of Labor and Industries or through a civil judgment entered by a court of limited or general jurisdiction entered during the term of this Contract.

12. Change in Status. In the event of substantive change in the legal status, organizational structure, or fiscal reporting responsibility of the Contractor, Contractor agrees to notify the Superintendent of the change. Contractor shall provide notice as soon as practicable, but no later than thirty (30) days after such a change takes effect.

13. Confidentiality. The Contractor acknowledges that all of the data, material and information which originates from this Contract, and any student assessment data, material and information which will come into its possession in connection with performance under this Contract, consists of confidential data owned by the Superintendent or confidential personally identifiable data subject to the federal Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232g; 34 CFR Part 99) or other privacy laws, and that the data must be secured and protected from unauthorized disclosure by the Contractor. The Contractor is wholly responsible for compliance with FERPA requirements.

The Contractor, therefore, agrees to hold all such material and information in strictest confidence, not to make use thereof other than for the performance of this Contract, to release it only to authorized employees and agents requiring such information and not release or disclose it to any other party. The Contractor agrees to release such information or material only to employees and agents who have signed a written agreement expressly prohibiting disclosure or usages not specifically authorized by this Contract.

14. Copyright Provisions. Unless otherwise provided, all Materials produced under this

Contract shall be considered "works for hire" as defined by the U.S. Copyright Act and copyright shall be owned by the Superintendent. The Superintendent shall be considered the author of such Materials. If Materials are not considered “works for hire”, Contractor hereby irrevocably assigns all right, title, and interest in Materials, including all intellectual property rights, to the Superintendent effective from the moment of creation of such Materials.

Materials means all items in any format and includes, but is not limited to, data, reports, documents, pamphlets, advertisements, books, magazines, surveys, studies, computer programs, films, tapes, and/or sound reproductions. Copyright ownership includes the right to patent, register and the ability to transfer these rights.

Contractor understands that, except where otherwise agreed to in writing or approved by the Superintendent or designee, all original works of authorship produced under this Contract shall carry a Creative Commons Attribution License, version 4.0 or later.

http://app.leg.wa.gov/RCW/default.aspx?cite=49.48.082 http://app.leg.wa.gov/RCW/default.aspx?cite=49.46 http://app.leg.wa.gov/RCW/default.aspx?cite=49.48 http://app.leg.wa.gov/RCW/default.aspx?cite=49.52 http://creativecommons.org/licenses/by/4.0/

Page 4 of 14 Contract 20250485 Attachment A – General Terms and Conditions between OSPI and

FORM SPI D-283 (Rev. 12/23)

All Materials the Contractor has adapted from others’ existing openly licensed resources must be licensed with the least restrictive open license possible that is not in conflict with existing licenses.

For Materials that are delivered under the Contract, but that incorporate pre-existing materials not produced under the Contract, Contractor will license the materials to allow others to translate, reproduce, distribute, prepare derivative works, publicly perform, and publicly display. If the Contractor would like to limit these pre-existing portions of the work to non-commercial use, the Creative Commons Attribution-NonCommercial (preferred) or Creative Commons Attribution-NonCommercial-ShareAlike licenses, version 4.0 or later, are acceptable for these specific sections.

The Contractor warrants and represents that Contractor has all rights and permissions, including intellectual property rights, moral rights and rights of publicity, necessary to apply such a license.

The Contractor shall exert all reasonable effort to advise the Superintendent, at the time of delivery of data furnished under this Contract, of all known or potential invasions of privacy contained therein and of any portion of such document which was not produced in the performance of this Contract. The Superintendent shall receive prompt written notice of each notice or claim of infringement received by the Contractor with respect to any data delivered under this Contract. The Superintendent shall have the right to modify or remove any restrictive markings placed upon the data by the Contractor.

15. Covenant Against Contingent Fees. The Contractor warrants that no person or…